Totolink WA300 Firmware vulnerabilities

3 CVEs affecting Totolink WA300 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-4497, published 2026-03-20.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-4497, published 2026-03-20. Critical severity, CVSS 9.8. EPSS: 3% chance of exploitation in the next 30 days. A vulnerability was determined in Totolink WA300 5.2cu.7112_B20190227. Affected by this issue is the function recvUpgradeNewFw of the file /cgi-bin/cstecgi.cgi. This manipulation causes os command…
CVE-2026-0641, published 2026-01-06. High severity, CVSS 8.8. EPSS: 2.6% chance of exploitation in the next 30 days. A security vulnerability has been detected in TOTOLINK WA300 5.2cu.7112_B20190227. This vulnerability affects the function sub_401510 of the file cstecgi.cgi. The manipulation of the argument…
CVE-2026-2167, published 2026-02-08. High severity, CVSS 8.8. EPSS: 2.6% chance of exploitation in the next 30 days. A vulnerability was detected in Totolink WA300 5.2cu.7112_B20190227. The impacted element is the function setAPNetwork of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument Ipaddr…